[fix] avoid NPE when CRL fails to parse (invalid str)

this resolves jruby/jruby#5619

Author: kares

src/main/java/org/jruby/ext/openssl/X509CRL.java

@@ -175,25 +175,21 @@ private byte[] getSignature() {
         return getCRL().getSignature();
     }
 
-    private static boolean avoidJavaSecurity = false;
+    private static final boolean avoidJavaSecurity = false; // true NOT SUPPORTED
 
-    private static java.security.cert.X509CRL generateCRL(
-        final byte[] bytes, final int offset, final int length)
+    private static java.security.cert.X509CRL generateCRL(final byte[] bytes, final int offset, final int length)
         throws GeneralSecurityException {
         CertificateFactory factory = SecurityHelper.getCertificateFactory("X.509");
-        return (java.security.cert.X509CRL) factory.generateCRL(
-            new ByteArrayInputStream(bytes, offset, length)
-        );
+        return (java.security.cert.X509CRL) factory.generateCRL(new ByteArrayInputStream(bytes, offset, length));
     }
 
-    private static X509CRLHolder parseCRLHolder(
-        final byte[] bytes, final int offset, final int length) throws IOException {
+    private static X509CRLHolder parseCRLHolder(final byte[] bytes, final int offset, final int length)
+        throws IOException {
         return new X509CRLHolder(new ByteArrayInputStream(bytes, offset, length));
     }
 
     @JRubyMethod(name = "initialize", rest = true, visibility = Visibility.PRIVATE)
-    public IRubyObject initialize(final ThreadContext context,
-        final IRubyObject[] args, final Block block) {
+    public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args, final Block block) {
         final Ruby runtime = context.runtime;
 
         this.extensions = runtime.newArray(8);
@@ -220,6 +216,10 @@ public IRubyObject initialize(final ThreadContext context,
             throw newCRLError(runtime, e);
         }
 
+        if (this.crl == null) {
+            throw newCRLError(runtime, ""); // MRI: "header too long" for OpenSSL::X509::CRL.new('')
+        }
+
         set_last_update( context, RubyTime.newTime(runtime, crl.getThisUpdate().getTime()) );
         set_next_update( context, RubyTime.newTime(runtime, crl.getNextUpdate().getTime()) );
         set_issuer( X509Name.newName(runtime, crl.getIssuerX500Principal()) );

src/test/ruby/x509/test_x509crl.rb

@@ -16,6 +16,8 @@ def test_new_crl
     if RUBY_VERSION >= '2.0.0' || defined? JRUBY_VERSION
       assert crl.inspect.index('#<OpenSSL::X509::CRL:') == 0, crl.inspect
     end
+
+    assert_raises(OpenSSL::X509::CRLError) { OpenSSL::X509::CRL.new('') }
   end
 
 REVOKED_TEXT = <<EOF